🇫🇷 French, 24 October 2026, PHP vulnerability
PHP2Shell Vulnerability Exploited Before Patch
Two vulnerabilities in PHP, affecting 70% of websites, were found using AI and exploited before patches were released.
The vulnerabilities, known as PHP2Shell, affect websites built on WordPress, Drupal, or PrestaShop, including online stores, associations, and public sites.
The first vulnerability was detected on August 1, 2026, by the security firm Calif using an OpenAI model, and was later confirmed by Wiz, a Google subsidiary, on August 19, 2026.
The vulnerabilities were exploited before patches were released on October 21, 2026, with thousands of attempts made in just 45 minutes, according to Cloudflare.